fix(storage): clear obsolete onboarding intent

[mikemikimike]

Issue

Fixes#3566.

Background

A stale connection-onboarding journal can become permanently unreplayable when the catalog contains the same provider slug with a different connection ID. Every subsequent interactive runtime-policy store open then fails.

Changes

• Treat the exact connection-id conflict as an obsolete onboarding intent.
• Clear that intent and allow the store to open.
• Preserve fail-closed recovery for all other errors.
• Add a regression test covering reopen success and journal cleanup.

Compatibility

Only stale intents with the explicit identity conflict are discarded. I/O failures, malformed journals, vault failures, and other recovery errors retain their existing fail-closed behavior.

Verification

• npm --workspace @maka/core run build — passed
• npm --workspace @maka/storage run build — passed
• node --test packages/storage/dist/__tests__/runtime-policy-stores.test.js — 47 passed, 6 skipped
• npx biome check packages/storage/src/runtime-policy/coordinator.ts packages/storage/src/__tests__/runtime-policy-stores.test.ts — passed

Notes

The skipped tests require POSIX permissions or symlink support unavailable in the Windows environment. Full repository build/lint were not run because this change is scoped to the storage workspace and its focused checks were sufficient for the affected path.

Generated-by: Codex

[Astro-Han]

Independent review at exact head bdc1d702dc34b254748cbfac4a38dbd6a2cb0c86.

APPROVE. The recovery path is correct and the regression test is the right shape.

The fix closes a real dead end: a runtime-policy-onboarding.json whose connectionId no longer matches the catalog previously escaped as commit_outcome_unknown, and because the intent file was never cleared, every subsequent open hit the same wall. Clearing the obsolete intent and returning makes the state self-healing, and the test proves it across two successive reopens rather than just one — which is what distinguishes "recovered" from "recovered once".

The narrowing is also correctly ordered: the obsolete-intent branch is checked before isCommitOutcomeUnknown, so genuinely unknown commit outcomes still propagate untouched. No behaviour change for any other invalid_document failure.

[P3] — packages/storage/src/runtime-policy/coordinator.ts:1399-1405 discriminates on free-text message equality:

error.code==='invalid_document'&&error.message==='Onboarding intent conflicts with the connection id'

invalid_document is raised from a dozen sites in connection-catalog-document.ts alone, so the message string is carrying the entire discrimination load for a control-flow decision that swallows an error. Rewording the throw at connection-catalog-document.ts:534 would silently restore the old dead end.

Mitigating this materially: the new test drives the real thrower end-to-end rather than constructing the error, so a reworded message does fail the suite. That is why this is [P3] and not higher — the coupling is covered, just implicitly. If you want it explicit, a dedicated error code (or an exported message constant shared by both sites) would make the contract local instead of spread across two files. Fine to leave as-is.

Verification: exact-head test is completed/success. The Dependency audit workflow does not appear on this head, which is correct rather than missing — it is path-filtered to package.json / lockfile / audit scripts, and this PR touches neither.

[mikemikimike]

Issue

Fixes#3566.

Background

A stale connection-onboarding journal can become permanently unreplayable when the catalog contains the same provider slug with a different connection ID. Every subsequent interactive runtime-policy store open then fails.

Changes

• Treat the exact connection-id conflict as an obsolete onboarding intent.
• Clear that intent and allow the store to open.
• Preserve fail-closed recovery for all other errors.
• Add a regression test covering reopen success and journal cleanup.

Compatibility

Only stale intents with the explicit identity conflict are discarded. I/O failures, malformed journals, vault failures, and other recovery errors retain their existing fail-closed behavior.

Verification

• npm --workspace @maka/core run build — passed
• npm --workspace @maka/storage run build — passed
• node --test packages/storage/dist/__tests__/runtime-policy-stores.test.js — 47 passed, 6 skipped
• npx biome check packages/storage/src/runtime-policy/coordinator.ts packages/storage/src/__tests__/runtime-policy-stores.test.ts — passed

Notes

The skipped tests require POSIX permissions or symlink support unavailable in the Windows environment. Full repository build/lint were not run because this change is scoped to the storage workspace and its focused checks were sufficient for the affected path.

Generated-by: Codex

[Astro-Han]

Independent review at exact head bdc1d702dc34b254748cbfac4a38dbd6a2cb0c86.

APPROVE. The recovery path is correct and the regression test is the right shape.

The fix closes a real dead end: a runtime-policy-onboarding.json whose connectionId no longer matches the catalog previously escaped as commit_outcome_unknown, and because the intent file was never cleared, every subsequent open hit the same wall. Clearing the obsolete intent and returning makes the state self-healing, and the test proves it across two successive reopens rather than just one — which is what distinguishes "recovered" from "recovered once".

The narrowing is also correctly ordered: the obsolete-intent branch is checked before isCommitOutcomeUnknown, so genuinely unknown commit outcomes still propagate untouched. No behaviour change for any other invalid_document failure.

[P3] — packages/storage/src/runtime-policy/coordinator.ts:1399-1405 discriminates on free-text message equality:

error.code==='invalid_document'&&error.message==='Onboarding intent conflicts with the connection id'

invalid_document is raised from a dozen sites in connection-catalog-document.ts alone, so the message string is carrying the entire discrimination load for a control-flow decision that swallows an error. Rewording the throw at connection-catalog-document.ts:534 would silently restore the old dead end.

Mitigating this materially: the new test drives the real thrower end-to-end rather than constructing the error, so a reworded message does fail the suite. That is why this is [P3] and not higher — the coupling is covered, just implicitly. If you want it explicit, a dedicated error code (or an exported message constant shared by both sites) would make the contract local instead of spread across two files. Fine to leave as-is.

Verification: exact-head test is completed/success. The Dependency audit workflow does not appear on this head, which is correct rather than missing — it is path-filtered to package.json / lockfile / audit scripts, and this PR touches neither.

[mikemikimike]

Issue

Fixes#3566.

Background

A stale connection-onboarding journal can become permanently unreplayable when the catalog contains the same provider slug with a different connection ID. Every subsequent interactive runtime-policy store open then fails.

Changes

• Treat the exact connection-id conflict as an obsolete onboarding intent.
• Clear that intent and allow the store to open.
• Preserve fail-closed recovery for all other errors.
• Add a regression test covering reopen success and journal cleanup.

Compatibility

Only stale intents with the explicit identity conflict are discarded. I/O failures, malformed journals, vault failures, and other recovery errors retain their existing fail-closed behavior.

Verification

• npm --workspace @maka/core run build — passed
• npm --workspace @maka/storage run build — passed
• node --test packages/storage/dist/__tests__/runtime-policy-stores.test.js — 47 passed, 6 skipped
• npx biome check packages/storage/src/runtime-policy/coordinator.ts packages/storage/src/__tests__/runtime-policy-stores.test.ts — passed

Notes

The skipped tests require POSIX permissions or symlink support unavailable in the Windows environment. Full repository build/lint were not run because this change is scoped to the storage workspace and its focused checks were sufficient for the affected path.

Generated-by: Codex

[Astro-Han]

Independent review at exact head bdc1d702dc34b254748cbfac4a38dbd6a2cb0c86.

APPROVE. The recovery path is correct and the regression test is the right shape.

The fix closes a real dead end: a runtime-policy-onboarding.json whose connectionId no longer matches the catalog previously escaped as commit_outcome_unknown, and because the intent file was never cleared, every subsequent open hit the same wall. Clearing the obsolete intent and returning makes the state self-healing, and the test proves it across two successive reopens rather than just one — which is what distinguishes "recovered" from "recovered once".

The narrowing is also correctly ordered: the obsolete-intent branch is checked before isCommitOutcomeUnknown, so genuinely unknown commit outcomes still propagate untouched. No behaviour change for any other invalid_document failure.

[P3] — packages/storage/src/runtime-policy/coordinator.ts:1399-1405 discriminates on free-text message equality:

error.code==='invalid_document'&&error.message==='Onboarding intent conflicts with the connection id'

invalid_document is raised from a dozen sites in connection-catalog-document.ts alone, so the message string is carrying the entire discrimination load for a control-flow decision that swallows an error. Rewording the throw at connection-catalog-document.ts:534 would silently restore the old dead end.

Mitigating this materially: the new test drives the real thrower end-to-end rather than constructing the error, so a reworded message does fail the suite. That is why this is [P3] and not higher — the coupling is covered, just implicitly. If you want it explicit, a dedicated error code (or an exported message constant shared by both sites) would make the contract local instead of spread across two files. Fine to leave as-is.

Verification: exact-head test is completed/success. The Dependency audit workflow does not appear on this head, which is correct rather than missing — it is path-filtered to package.json / lockfile / audit scripts, and this PR touches neither.

[mikemikimike]

Issue

Fixes#3566.

Background

A stale connection-onboarding journal can become permanently unreplayable when the catalog contains the same provider slug with a different connection ID. Every subsequent interactive runtime-policy store open then fails.

Changes

• Treat the exact connection-id conflict as an obsolete onboarding intent.
• Clear that intent and allow the store to open.
• Preserve fail-closed recovery for all other errors.
• Add a regression test covering reopen success and journal cleanup.

Compatibility

Only stale intents with the explicit identity conflict are discarded. I/O failures, malformed journals, vault failures, and other recovery errors retain their existing fail-closed behavior.

Verification

• npm --workspace @maka/core run build — passed
• npm --workspace @maka/storage run build — passed
• node --test packages/storage/dist/__tests__/runtime-policy-stores.test.js — 47 passed, 6 skipped
• npx biome check packages/storage/src/runtime-policy/coordinator.ts packages/storage/src/__tests__/runtime-policy-stores.test.ts — passed

Notes

The skipped tests require POSIX permissions or symlink support unavailable in the Windows environment. Full repository build/lint were not run because this change is scoped to the storage workspace and its focused checks were sufficient for the affected path.

Generated-by: Codex

[Astro-Han]

Independent review at exact head bdc1d702dc34b254748cbfac4a38dbd6a2cb0c86.

APPROVE. The recovery path is correct and the regression test is the right shape.

The fix closes a real dead end: a runtime-policy-onboarding.json whose connectionId no longer matches the catalog previously escaped as commit_outcome_unknown, and because the intent file was never cleared, every subsequent open hit the same wall. Clearing the obsolete intent and returning makes the state self-healing, and the test proves it across two successive reopens rather than just one — which is what distinguishes "recovered" from "recovered once".

The narrowing is also correctly ordered: the obsolete-intent branch is checked before isCommitOutcomeUnknown, so genuinely unknown commit outcomes still propagate untouched. No behaviour change for any other invalid_document failure.

[P3] — packages/storage/src/runtime-policy/coordinator.ts:1399-1405 discriminates on free-text message equality:

error.code==='invalid_document'&&error.message==='Onboarding intent conflicts with the connection id'

invalid_document is raised from a dozen sites in connection-catalog-document.ts alone, so the message string is carrying the entire discrimination load for a control-flow decision that swallows an error. Rewording the throw at connection-catalog-document.ts:534 would silently restore the old dead end.

Mitigating this materially: the new test drives the real thrower end-to-end rather than constructing the error, so a reworded message does fail the suite. That is why this is [P3] and not higher — the coupling is covered, just implicitly. If you want it explicit, a dedicated error code (or an exported message constant shared by both sites) would make the contract local instead of spread across two files. Fine to leave as-is.

Verification: exact-head test is completed/success. The Dependency audit workflow does not appear on this head, which is correct rather than missing — it is path-filtered to package.json / lockfile / audit scripts, and this PR touches neither.

[mikemikimike]

Issue

Fixes#3566.

Background

A stale connection-onboarding journal can become permanently unreplayable when the catalog contains the same provider slug with a different connection ID. Every subsequent interactive runtime-policy store open then fails.

Changes

• Treat the exact connection-id conflict as an obsolete onboarding intent.
• Clear that intent and allow the store to open.
• Preserve fail-closed recovery for all other errors.
• Add a regression test covering reopen success and journal cleanup.

Compatibility

Only stale intents with the explicit identity conflict are discarded. I/O failures, malformed journals, vault failures, and other recovery errors retain their existing fail-closed behavior.

Verification

• npm --workspace @maka/core run build — passed
• npm --workspace @maka/storage run build — passed
• node --test packages/storage/dist/__tests__/runtime-policy-stores.test.js — 47 passed, 6 skipped
• npx biome check packages/storage/src/runtime-policy/coordinator.ts packages/storage/src/__tests__/runtime-policy-stores.test.ts — passed

Notes

The skipped tests require POSIX permissions or symlink support unavailable in the Windows environment. Full repository build/lint were not run because this change is scoped to the storage workspace and its focused checks were sufficient for the affected path.

Generated-by: Codex

[Astro-Han]

Independent review at exact head bdc1d702dc34b254748cbfac4a38dbd6a2cb0c86.

APPROVE. The recovery path is correct and the regression test is the right shape.

The fix closes a real dead end: a runtime-policy-onboarding.json whose connectionId no longer matches the catalog previously escaped as commit_outcome_unknown, and because the intent file was never cleared, every subsequent open hit the same wall. Clearing the obsolete intent and returning makes the state self-healing, and the test proves it across two successive reopens rather than just one — which is what distinguishes "recovered" from "recovered once".

The narrowing is also correctly ordered: the obsolete-intent branch is checked before isCommitOutcomeUnknown, so genuinely unknown commit outcomes still propagate untouched. No behaviour change for any other invalid_document failure.

[P3] — packages/storage/src/runtime-policy/coordinator.ts:1399-1405 discriminates on free-text message equality:

error.code==='invalid_document'&&error.message==='Onboarding intent conflicts with the connection id'

invalid_document is raised from a dozen sites in connection-catalog-document.ts alone, so the message string is carrying the entire discrimination load for a control-flow decision that swallows an error. Rewording the throw at connection-catalog-document.ts:534 would silently restore the old dead end.

Mitigating this materially: the new test drives the real thrower end-to-end rather than constructing the error, so a reworded message does fail the suite. That is why this is [P3] and not higher — the coupling is covered, just implicitly. If you want it explicit, a dedicated error code (or an exported message constant shared by both sites) would make the contract local instead of spread across two files. Fine to leave as-is.

Verification: exact-head test is completed/success. The Dependency audit workflow does not appear on this head, which is correct rather than missing — it is path-filtered to package.json / lockfile / audit scripts, and this PR touches neither.

[mikemikimike]

Issue

Fixes#3566.

Background

A stale connection-onboarding journal can become permanently unreplayable when the catalog contains the same provider slug with a different connection ID. Every subsequent interactive runtime-policy store open then fails.

Changes

• Treat the exact connection-id conflict as an obsolete onboarding intent.
• Clear that intent and allow the store to open.
• Preserve fail-closed recovery for all other errors.
• Add a regression test covering reopen success and journal cleanup.

Compatibility

Only stale intents with the explicit identity conflict are discarded. I/O failures, malformed journals, vault failures, and other recovery errors retain their existing fail-closed behavior.

Verification

• npm --workspace @maka/core run build — passed
• npm --workspace @maka/storage run build — passed
• node --test packages/storage/dist/__tests__/runtime-policy-stores.test.js — 47 passed, 6 skipped
• npx biome check packages/storage/src/runtime-policy/coordinator.ts packages/storage/src/__tests__/runtime-policy-stores.test.ts — passed

Notes

The skipped tests require POSIX permissions or symlink support unavailable in the Windows environment. Full repository build/lint were not run because this change is scoped to the storage workspace and its focused checks were sufficient for the affected path.

Generated-by: Codex

[Astro-Han]

Independent review at exact head bdc1d702dc34b254748cbfac4a38dbd6a2cb0c86.

APPROVE. The recovery path is correct and the regression test is the right shape.

The fix closes a real dead end: a runtime-policy-onboarding.json whose connectionId no longer matches the catalog previously escaped as commit_outcome_unknown, and because the intent file was never cleared, every subsequent open hit the same wall. Clearing the obsolete intent and returning makes the state self-healing, and the test proves it across two successive reopens rather than just one — which is what distinguishes "recovered" from "recovered once".

The narrowing is also correctly ordered: the obsolete-intent branch is checked before isCommitOutcomeUnknown, so genuinely unknown commit outcomes still propagate untouched. No behaviour change for any other invalid_document failure.

[P3] — packages/storage/src/runtime-policy/coordinator.ts:1399-1405 discriminates on free-text message equality:

error.code==='invalid_document'&&error.message==='Onboarding intent conflicts with the connection id'

invalid_document is raised from a dozen sites in connection-catalog-document.ts alone, so the message string is carrying the entire discrimination load for a control-flow decision that swallows an error. Rewording the throw at connection-catalog-document.ts:534 would silently restore the old dead end.

Mitigating this materially: the new test drives the real thrower end-to-end rather than constructing the error, so a reworded message does fail the suite. That is why this is [P3] and not higher — the coupling is covered, just implicitly. If you want it explicit, a dedicated error code (or an exported message constant shared by both sites) would make the contract local instead of spread across two files. Fine to leave as-is.

Verification: exact-head test is completed/success. The Dependency audit workflow does not appear on this head, which is correct rather than missing — it is path-filtered to package.json / lockfile / audit scripts, and this PR touches neither.

[mikemikimike]

Issue

Fixes#3566.

Background

A stale connection-onboarding journal can become permanently unreplayable when the catalog contains the same provider slug with a different connection ID. Every subsequent interactive runtime-policy store open then fails.

Changes

• Treat the exact connection-id conflict as an obsolete onboarding intent.
• Clear that intent and allow the store to open.
• Preserve fail-closed recovery for all other errors.
• Add a regression test covering reopen success and journal cleanup.

Compatibility

Only stale intents with the explicit identity conflict are discarded. I/O failures, malformed journals, vault failures, and other recovery errors retain their existing fail-closed behavior.

Verification

• npm --workspace @maka/core run build — passed
• npm --workspace @maka/storage run build — passed
• node --test packages/storage/dist/__tests__/runtime-policy-stores.test.js — 47 passed, 6 skipped
• npx biome check packages/storage/src/runtime-policy/coordinator.ts packages/storage/src/__tests__/runtime-policy-stores.test.ts — passed

Notes

The skipped tests require POSIX permissions or symlink support unavailable in the Windows environment. Full repository build/lint were not run because this change is scoped to the storage workspace and its focused checks were sufficient for the affected path.

Generated-by: Codex

[Astro-Han]

Independent review at exact head bdc1d702dc34b254748cbfac4a38dbd6a2cb0c86.

APPROVE. The recovery path is correct and the regression test is the right shape.

The fix closes a real dead end: a runtime-policy-onboarding.json whose connectionId no longer matches the catalog previously escaped as commit_outcome_unknown, and because the intent file was never cleared, every subsequent open hit the same wall. Clearing the obsolete intent and returning makes the state self-healing, and the test proves it across two successive reopens rather than just one — which is what distinguishes "recovered" from "recovered once".

The narrowing is also correctly ordered: the obsolete-intent branch is checked before isCommitOutcomeUnknown, so genuinely unknown commit outcomes still propagate untouched. No behaviour change for any other invalid_document failure.

[P3] — packages/storage/src/runtime-policy/coordinator.ts:1399-1405 discriminates on free-text message equality:

error.code==='invalid_document'&&error.message==='Onboarding intent conflicts with the connection id'

invalid_document is raised from a dozen sites in connection-catalog-document.ts alone, so the message string is carrying the entire discrimination load for a control-flow decision that swallows an error. Rewording the throw at connection-catalog-document.ts:534 would silently restore the old dead end.

Mitigating this materially: the new test drives the real thrower end-to-end rather than constructing the error, so a reworded message does fail the suite. That is why this is [P3] and not higher — the coupling is covered, just implicitly. If you want it explicit, a dedicated error code (or an exported message constant shared by both sites) would make the contract local instead of spread across two files. Fine to leave as-is.

Verification: exact-head test is completed/success. The Dependency audit workflow does not appear on this head, which is correct rather than missing — it is path-filtered to package.json / lockfile / audit scripts, and this PR touches neither.

[mikemikimike]

Issue

Fixes#3566.

Background

A stale connection-onboarding journal can become permanently unreplayable when the catalog contains the same provider slug with a different connection ID. Every subsequent interactive runtime-policy store open then fails.

Changes

• Treat the exact connection-id conflict as an obsolete onboarding intent.
• Clear that intent and allow the store to open.
• Preserve fail-closed recovery for all other errors.
• Add a regression test covering reopen success and journal cleanup.

Compatibility

Only stale intents with the explicit identity conflict are discarded. I/O failures, malformed journals, vault failures, and other recovery errors retain their existing fail-closed behavior.

Verification

• npm --workspace @maka/core run build — passed
• npm --workspace @maka/storage run build — passed
• node --test packages/storage/dist/__tests__/runtime-policy-stores.test.js — 47 passed, 6 skipped
• npx biome check packages/storage/src/runtime-policy/coordinator.ts packages/storage/src/__tests__/runtime-policy-stores.test.ts — passed

Notes

The skipped tests require POSIX permissions or symlink support unavailable in the Windows environment. Full repository build/lint were not run because this change is scoped to the storage workspace and its focused checks were sufficient for the affected path.

Generated-by: Codex

[Astro-Han]

Independent review at exact head bdc1d702dc34b254748cbfac4a38dbd6a2cb0c86.

APPROVE. The recovery path is correct and the regression test is the right shape.

The fix closes a real dead end: a runtime-policy-onboarding.json whose connectionId no longer matches the catalog previously escaped as commit_outcome_unknown, and because the intent file was never cleared, every subsequent open hit the same wall. Clearing the obsolete intent and returning makes the state self-healing, and the test proves it across two successive reopens rather than just one — which is what distinguishes "recovered" from "recovered once".

The narrowing is also correctly ordered: the obsolete-intent branch is checked before isCommitOutcomeUnknown, so genuinely unknown commit outcomes still propagate untouched. No behaviour change for any other invalid_document failure.

[P3] — packages/storage/src/runtime-policy/coordinator.ts:1399-1405 discriminates on free-text message equality:

error.code==='invalid_document'&&error.message==='Onboarding intent conflicts with the connection id'

invalid_document is raised from a dozen sites in connection-catalog-document.ts alone, so the message string is carrying the entire discrimination load for a control-flow decision that swallows an error. Rewording the throw at connection-catalog-document.ts:534 would silently restore the old dead end.

Mitigating this materially: the new test drives the real thrower end-to-end rather than constructing the error, so a reworded message does fail the suite. That is why this is [P3] and not higher — the coupling is covered, just implicitly. If you want it explicit, a dedicated error code (or an exported message constant shared by both sites) would make the contract local instead of spread across two files. Fine to leave as-is.

Verification: exact-head test is completed/success. The Dependency audit workflow does not appear on this head, which is correct rather than missing — it is path-filtered to package.json / lockfile / audit scripts, and this PR touches neither.